CVE-2023-38545

CVE-2023-38545 is a critical heap-based buffer overflow vulnerability in curl's SOCKS5 proxy handshake, affecting products from Fedora, Haxx, Microsoft, and NetApp. It occurs when curl attempts to pass a hostname longer than 255 bytes to the proxy, leading to an incorrect local variable state and the oversized hostname being copied to a heap buffer. With a CVSS score of 9.8, this vulnerability has a network attack vector, low attack complexity, and can lead to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating high awareness.